@go-to-k/cdkd 0.298.2 → 0.298.3

package/dist/{provider-classes-B74Nt7nS.js → provider-classes-BTP4rLU6.js}

@@ -2,17 +2,17 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-CwKiK9nS.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as resolveAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ac as rewriteTemplateAssetReferences, ai as s3BucketArn, al as decodeListingKey, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bl as displayAssemblyPath, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, cl as canonicalizeRegion, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, ec as stringifyValue, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, ho as requireConfigObject, hs as carriesSecretMask, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, ll as derivePartitionAndUrlSuffix, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tt as markRefusedBeforeApplying, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, x as withApiLimit, xl as renderAssemblyPathEscape, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, yl as describeFileReadFailure, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-BgWY0v3K.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-KCSxfQZh.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BzEA5Cka.js";
-import { RDSProvider } from "./rds-provider-D4kq6O-L.js";
-import { NeptuneProvider } from "./neptune-provider-BGAmbyRB.js";
-import { ASGProvider } from "./asg-provider-Ds5ElkGf.js";
+import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cl as renderAssemblyPathEscape, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as displayAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ai as s3BucketArn, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, dl as derivePartitionAndUrlSuffix, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, gs as carriesSecretMask, ho as requireConfigObject, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oc as rewriteTemplateAssetReferences, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, ps as recordAttributeIdCopy, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sl as decodeListingKey, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tc as stringifyValue, tt as markRefusedBeforeApplying, ul as canonicalizeRegion, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, wl as resolveAssemblyPath, x as withApiLimit, xl as describeFileReadFailure, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-DLGCuN4i.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-B020NDGS.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BQnReLnG.js";
+import { RDSProvider } from "./rds-provider-DcfF-k86.js";
+import { NeptuneProvider } from "./neptune-provider-DDFjTv9k.js";
+import { ASGProvider } from "./asg-provider-CvJsMScM.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
-import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
+import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
@@ -6723,6 +6723,45 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 const SNS_SUBSCRIPTION_DELETE_THREW_REASON = "the Unsubscribe call did not complete, so the old subscription is unproven";
+const MUTABLE_ATTRIBUTES = [
+	"RawMessageDelivery",
+	"FilterPolicy",
+	"FilterPolicyScope",
+	"RedrivePolicy",
+	"DeliveryPolicy",
+	"ReplayPolicy",
+	"SubscriptionRoleArn"
+];
+const RESET_VALUES = {
+	RawMessageDelivery: "false",
+	FilterPolicy: "",
+	FilterPolicyScope: "MessageAttributes",
+	RedrivePolicy: ""
+};
+const CREATE_ONLY_FIELDS = [
+	"TopicArn",
+	"Protocol",
+	"Endpoint"
+];
+function toAttributeValue(key, value) {
+	if (value === void 0) return void 0;
+	if (key === "FilterPolicy" || key === "RedrivePolicy" || key === "DeliveryPolicy" || key === "ReplayPolicy") return typeof value === "string" ? value : JSON.stringify(value);
+	return stringifyValue(value);
+}
+function sameAttributeValue(name, desired, current) {
+	if (current === void 0) return desired === RESET_VALUES[name];
+	if (desired === current) return true;
+	try {
+		return JSON.stringify(JSON.parse(desired)) === JSON.stringify(JSON.parse(current));
+	} catch {
+		return false;
+	}
+}
+function filterPolicyCleared(plan, current) {
+	const planned = plan.find(([name]) => name === "FilterPolicy");
+	if (planned !== void 0) return planned[1] === "";
+	return current["FilterPolicy"] === void 0 || current["FilterPolicy"] === "";
+}
 var SNSSubscriptionProvider = class {
 	snsClient;
 	logger = getLogger().child("SNSSubscriptionProvider");
@@ -6743,7 +6782,7 @@ var SNSSubscriptionProvider = class {
 		const awsClients = getAwsClients();
 		this.snsClient = awsClients.sns;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SNS subscription ${logicalId}`);
 		const topicArn = properties["TopicArn"];
 		const protocol = properties["Protocol"];
@@ -6781,16 +6820,71 @@ var SNSSubscriptionProvider = class {
 				attributes: definedAttributes({ Arn: response.SubscriptionArn?.startsWith("arn:") ? response.SubscriptionArn : void 0 })
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SNS subscription ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapMaskedAwsCallError(maskerOrIdentity(context?.maskSecrets), error, `Failed to create SNS subscription ${logicalId}`, resourceType, logicalId, void 0);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating SNS subscription ${logicalId}: ${physicalId}`);
+		const plan = await this.planInPlaceUpdate(logicalId, physicalId, resourceType, properties, context);
+		if (plan === void 0) return this.replace(logicalId, physicalId, resourceType, properties, context);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		for (const [name, value] of plan) try {
+			await this.snsClient.send(new SetSubscriptionAttributesCommand({
+				SubscriptionArn: physicalId,
+				AttributeName: name,
+				AttributeValue: value
+			}));
+		} catch (error) {
+			throw this.wrapMaskedAwsCallError(mask, error, `Failed to update SNS subscription ${logicalId} (attribute ${name})`, resourceType, logicalId, physicalId);
+		}
+		const changed = plan.map(([name]) => name).join(", ") || "no attribute differed";
+		this.logger.debug(safeMsg`Updated SNS subscription ${logicalId} in place: ${changed}`);
+		return {
+			physicalId,
+			wasReplaced: false,
+			attributes: definedAttributes({ Arn: physicalId.startsWith("arn:") ? physicalId : void 0 })
+		};
+	}
+	async planInPlaceUpdate(logicalId, physicalId, resourceType, properties, context) {
+		if (physicalId === "PendingConfirmation" || physicalId === "pending confirmation") return;
+		let current;
+		try {
+			current = (await this.snsClient.send(new GetSubscriptionAttributesCommand({ SubscriptionArn: physicalId })))?.Attributes;
+		} catch (error) {
+			if (error instanceof NotFoundException) return void 0;
+			throw this.wrapMaskedAwsCallError(maskerOrIdentity(context?.maskSecrets), error, `Failed to update SNS subscription ${logicalId}: could not read its attributes`, resourceType, logicalId, physicalId);
+		}
+		if (current === void 0 || current["PendingConfirmation"] === "true") return void 0;
+		for (const field of CREATE_ONLY_FIELDS) {
+			const desired = properties[field];
+			if (desired !== void 0 && stringifyValue(desired) !== current[field]) return void 0;
+		}
+		const plan = [];
+		for (const name of MUTABLE_ATTRIBUTES) {
+			const desired = toAttributeValue(name, properties[name]);
+			const now = current[name];
+			if (desired !== void 0) {
+				if (!sameAttributeValue(name, desired, now)) plan.push([name, desired]);
+				continue;
+			}
+			if (now === void 0 || now === "") continue;
+			if (name === "FilterPolicyScope" && filterPolicyCleared(plan, current)) continue;
+			const reset = RESET_VALUES[name];
+			if (reset === void 0) return void 0;
+			if (now !== reset) plan.push([name, reset]);
+		}
+		const policy = plan.find(([name]) => name === "FilterPolicy");
+		if (policy !== void 0 && policy[1] !== "" && plan.some(([name]) => name === "FilterPolicyScope")) return;
+		return plan;
+	}
+	wrapMaskedAwsCallError(mask, error, prefix, resourceType, logicalId, physicalId) {
+		return wrapMaskedAwsError(mask, error, (text) => new ProvisioningError(`${prefix}: ${text}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0));
+	}
+	async replace(logicalId, physicalId, resourceType, properties, context) {
 		let deleteResult = void 0;
 		let deleteThrew = false;
 		try {
-			deleteResult = await this.delete(logicalId, physicalId, resourceType);
+			deleteResult = await this.delete(logicalId, physicalId, resourceType, void 0, { expectedRegion: context?.expectedRegion });
 		} catch (error) {
 			deleteThrew = true;
 			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${safeStringify(error)}`);
@@ -6800,7 +6894,7 @@ var SNSSubscriptionProvider = class {
 			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${notDeletedReason}`);
 			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Usually the Unsubscribe itself failed (a throttle, a denied sns:Unsubscribe) and the state record is FINE — clear that cause and re-run, or remove the old subscription in AWS by hand. Repair the state record only when the warning says the recorded physical id is malformed, which is the latent skip arm rather than this one.`, resourceType, logicalId, physicalId));
 		}
-		const createResult = await this.create(logicalId, resourceType, properties);
+		const createResult = await this.create(logicalId, resourceType, properties, context?.maskSecrets === void 0 ? void 0 : { maskSecrets: context.maskSecrets });
 		return {
 			physicalId: createResult.physicalId,
 			wasReplaced: true,
@@ -44382,6 +44476,15 @@ var NestedStackProvider = class {
 		if (!childStateData) throw markNonRetryable(/* @__PURE__ */ new Error(`Child stack state ${displayStackName(childStackName)} not found after deploy — NestedStackProvider invariant violated.`));
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion, runAccountOf(ctx));
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
+		const rowSecrets = getCurrentResourceSecrets();
+		if (rowSecrets !== void 0) {
+			const childResources = childStateData.state.resources;
+			const ids = childResources !== null && typeof childResources === "object" ? Object.values(childResources).map((record) => record?.physicalId).filter((id) => typeof id === "string" && id !== "") : [];
+			for (const value of Object.values(attributes)) {
+				if (typeof value !== "string") continue;
+				for (const id of ids) if (value.includes(id)) recordAttributeIdCopy(rowSecrets, id);
+			}
+		}
 		const noEchoAttributeNames = [];
 		const identity = credentialFingerprint(ambientCredentialConfig());
 		for (const [outputKey, persisted] of Object.entries(childStateData.state.outputs ?? {})) {
@@ -44865,4 +44968,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-B74Nt7nS.js.map
+//# sourceMappingURL=provider-classes-BTP4rLU6.js.map